validation from argo cd

[saiharshitachava]

I created an argo cd application by using kustomize framework

Whenever I merge something in repo, argo cd will try to sync which is expected

I want to validate the data before merge so that I dont have sync failures due to bad configurations. Do we have any validators available in argo cd so that we can trigger them before the merge and argo cd tries actual sync?

[crenshaw-dev]

Argo CD can really only help you with the "CD" part - pre-merge checks is more a CI job. At Intuit, at least in some cases, we use GitHub Actions and a simple script to check that kustomize build works before allowing a PR to be merged.

[yogeshg]

It would be great if you could share templates of such scripts.

[crenshaw-dev]

It's really as simple as it sounds.

git clone <manifest repo>
kustomize build <app path>

If either of those fails, the CI fails.

[wyardley]

I would add, it's a good idea (IMO) to run tools like kubeconform against the rendered configs to check for more subtle errors. I'm not sure how to do it for things using the argo application type with a helm source, but in a general sense, you can do something like:

[command to use helm or kustomize to render configs into one directory] > /some/validation/directory
kubeconform -strict \
             --kubernetes-version "$TARGET_KUBE_VERSION" \
             -schema-location default \
             -schema-location \
             'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
             -output pretty -verbose \
             /some/validation/directory

(the second -schema-location is useful if you have CRDs from some common sources, and additional schema sources can be added, but it can be omitted otherwise... if you have CRDs present for which there are no schemas, you may have to omit -strict).

here is an example validation script for Flux. Not sure if there's something similar for Argo that can parse the various ways applications can be specified in Argo, but just posting in case it's helpful, or provides more insight into the original request.

kustomize build won't necessarily catch failures with actually invalid kube configs.

[wyardley]

#11722 (comment)
This comment (and the issue are part of) are both a good explanation of why this is important, and also why it's hard to accomplish at present.